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Abstract. Self-tested quantum information processing provides a means for doing useful information 
processing with untrusted quantum apparatus. Previous work was limited to performing computations 
and protocols in real Hilbert spaces, which is not a serious obstacle if one is only interested in final 
' measurement statistics being correct (for example, getting the correct factors of a large number after 

running Shor's factoring algorithm). This limitation was shown by McKague et al. to be fundamental, 
since there is no way to experimentally distinguish any quantum experiment from a special simulation 
using states and operators with only real coefficients. 

In this paper, we show that one can still do a meaningful self-test of quantum apparatus with complex 
amplitudes. In particular, we define a family of simulations of quantum experiments, based on complex 
conjugation, with two interesting properties. First, we are able to define a self-test which may be passed 
(~| , only by states and operators that are equivalent to simulations within the family. This extends work 

^ l' of Mayers and Yao and Magniez et al. in self-testing of quantum apparatus, and includes a complex 

measurement. Second, any of the simulations in the family may be used to implement a secure 6-state 
f~| . QKD protocol, which was previously not known to be implementable in a self-tested framework. 
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In |MY04j . |MY98j . Mayers and Yao introduced the concept of self-testing quantum apparatus 
^ I with a test for EPR sources and a select set of measurements. In a parallel development, van Dam 

et al. |vMMSOO] introduced the notion of self-testers for quantum circuits in the case where the 
dimension of the Hilbert space is known. These results were then combined and improved upon by 
Magniez et al. in |MMMU06) . who give a construction for self-testable circuits without knowledge 
' of the dimension of the Hilbert space. 

The Mayers- Yao test, and the test of Magniez et al., only allowed for the testing of states 
and operators that are equivalent to states and operators in a real Hilbert space. McKague et 
al. |MMG09] showed that in such settings with untrusted apparatus, one cannot experimentally 
distinguish a quantum system with states and evolution involving complex amplitudes from a special 
simulation using only real amplitudes. In addition to the implications for self-testing untrusted 
I quantum apparatus, this also resolved an open question posed by Gisin [ GisOTj related to the 

violation of Bell inequalities. It is important to note that the real simulation does not preserve 
inner product relationships from the system it is simulating. At first glance, this suggests that the 
well-known 6-state protocol [BBBW84] . |Bru98| might not be secure in a setting with untrusted 
apparatus, since the simulated versions of the six quantum states could be more distinguishable 
than the proofs of security assume, and an adversary could exploit this additional distinguishability 
and compromise security. 

In fact, it is easy to describe such an insecure implementation of the 6-state protocol with un- 
trusted apparatus, however even an implementation of standard BB84 quantum key establishment 
with untrusted apparatus is insecure if proper measures are not taken in order to rule out "side- 
channel" attacks. We show that with comparable precautions as those proposed by Mayers and 
Yao the 6-state protocol remains secure. 

This paper starts by describing a general family of simulations that will reproduce the same 
statistics as any given "reference" experiment, and are thus experimentally indistinguishable from 



said experiment. We show how the real Hilbert space simulation given in |MMG09] is equivalent 
to a special case of this family of simulations. The fact that these simulations work is not very 
surprising: they are essentially mixtures of the reference experiment, or the complex conjugate 
of the reference experiment. Thus, we have a more general collection of experiments that are 
experimentally indistinguishable in a self-testing framework. What is particularly remarkable is 
that we are able to describe, in section 14.11 ^ family of self-tests which can only be passed by 
simulations from the general family we describe (up to equivalence, as defined below). This is 
summarized in Theorem [2j 

The self-tests allow us to put a physical experiment in a general collection of experiments, and 
we are then able to show that the 6-state protocol is secure for all the experiments within this 
collection. This shows that it is possible to define a secure 6-state protocol within the self-testing 
framework. 

In section [3l we prepare for the proof of Theorem [21 by discussing the Mayers- Yao self-tested 
source result given in Theorem [H a new proof of which is given in appendix O This new proof is 
shorter and simpler, and more easily extended to prove our more general result. 

Then, in section 14. H we describe a new self-test for an EPR source and local measurement 
apparatus that will uniquely characterize the general equivalence class associated with this quantum 
state and measurement operators. 

In section [5l we discuss the cryptographic implications, and why a properly self-tested 6-state 
protocol is still secure. 

Lastly, in section [6l we discuss some open problems and future directions, including the robust- 
ness of the generalized self-tests. 

2 Simulations 

In this section we extend the work of McKague et al. in |MMG09] . There the authors gave a con- 
struction that allowed the outcomes of any experiment (the reference experiment) to be duplicated 
(simulated) by another experiment (the simulation) which is described entirely using real numbers. 
That is to say, all the states, measurement operators, unitaries, Kraus operators, and Hamiltonians 
are given as vectors and matrices over the real numbers. Of particular interest here is the fact that 
the simulation is, in general, not equivalent to the reference experiment according to definition [1] 
below. 

In this section we give a construction for a wider family of simulations. The different simulations 
in the family are, in general, not equivalent to either the reference experiment nor each other. We 
will be most interested in states and measurements, but, as with the real simulation in |MMG09] . 
it is also possible to simulate discrete and continuous time evolution. 

The simulations rely on the simple observation that transforming an experiment by complex 
conjugation does not alter the statistics it generates. We could also take a classical mixture of 
the reference experiment and its complex conjugation, flipping a coin (or controlling on a qubit) 
beforehand to decide which one to perform. In the remainder of this section we fill in some details 
about the simulations defined by these mixtures. 

2.1 States and measurements 

Consider a reference stat^ lip) measured according to a reference POVM {Pk}- We may duplicate 
the statistics of this experiment using the complex conjugate state {tp*) and POVM {P^}- In 



^ We may consider mixed states as well, but it is not necessary for our discussion. 



addition, we could do some combination of the two; we may add an additional qubit register which 
records which of the two experiments to perform: |0) for the reference experiment, and |1) for the 
complex conjugate. This qubit may be in any state, and not necessarily pure. We then arrive at a 
new state 

= a |0)(0| ® IVXV'I + (1 - a) |1>(1| ® |V'*>(V'*I + c|0)(l| ® + c* |1)(0| ® (1) 

with a > and |c| < a(l — a). The important feature is that when we project onto |0)(0| or |1)(1| 
we get either \tp) or respectively. For the measurement, we form the POVM 

{|O)(O|®Pfc + |l)(l|0Pfc*}- (2) 

This POVM measurement is equivalent to measuring the added qubit, collapsing the state into 
either \tp) or \ip*) and then measuring either {Pk} or {P^} as appropriate; thus the statistics of the 
experiment are preserved. 

Different simulations are arrived at by choosing different values of a and c. If a = 1 and c = 
then we obtain the reference experiment. For a = and c = we obtain the complex conjugate. 
Another interesting case is when o = c = ^, in which case we obtain (up to a local change of bases) 
the real simulation of [MMG09] as shown in appendix [Bl 

2.2 Operators 

Although it will not be necessary for our discussion, it is possible to simulate a reference experiment 
which includes evolution, according to a unitary, completely-positive map, or Hamiltonian. The 
details are discussed in appendix lAl 

2.3 Non-local computations 

For multi-party experiments, such as the Mayers- Yao test, we would need the simulation to be 
performed in a local fashion with the measurements operating on local systems only. As defined 
above this not the case, but it is easy to modify the operators to make it so. We simply add an 
extra qubit for each party and record in each qubit whether to perform the reference experiment 
or the complex conjugate. We arrive at states analogous to that in equation [H but with |0) and 
|1) replaced with logical states |o) = |00 ... 0), |l) = |11 . . . 1) defined on the extra qubits held by 
the various parties. Finally, each party conditions their operations on their local copy of the qubit, 
applying either the reference operation or the complex conjugate. 

3 Mayers- Yao self-test 

The goal of the Mayers- Yao test is to compare two experiments. The first experiment is the refer- 
ence experiment, which is the experiment we wish to implement. It is a blueprint, or gold standard, 
against which we compare the other experiment, the physical experiment, which is the experiment 
that is actually performed. Within the physical experiment we consider the entire physical appa- 
ratus, including the environment, so that we obtain a pure state on a Hilbert space of unknown 
dimension (however, we will limit ourselves to finite dimensions.) The reference and physical experi- 
ments consist of reference and physical states, operations, and measurements. The two experiments 
are compared through the statistics that they generate. 



3.1 Equivalence 



The proof considers a particular reference experiment, as described in section [3^21 This experiment 
is defined on a pair of qubits, so we will limit our discussion to such systems. As well, we consider 
only pure states - the physical system is unlimited (but finite) in size, so we may include the 
environment to obtain a pure state. The conclusion of Mayers and Yao is that if the statistics of a 
physical experiment agree with that of the reference experiment, then the physical experiment is 
equivalent to the reference experiment, under a particular notion of equivalence. 

When defining a notion of equivalence in this setting we must first consider how me might 
change the reference experiment in a way that preserves the statistics of the outcomes. Any such 
change is invisible from the perspective of the statistics and hence we cannot rule them out. Here 
is a list of such changes: 

1. Local changes of basis 

2. Adding ancillae to physical systems, prepared in any joint state (the measurement does not act 
on them) 

3. Changing the action of the observables outside the support of the state 

4. Locally embedding the state and operators in a larger (or smaller) Hilbert space. 

In order to accommodate these various changes we define equivalence as follows. 

Definition 1. A reference experiment is described by a n-partite state on Hilbert space X = 
Xi eg) ...Xn and local measurement observables Mm for various m. Further, consider a physical 
experiment described by a n-partite state on Hilbert space y = yi ■ ■ ■ <Si y-n (ind local mea- 
surement observables for various m. We say that the physical experiment is equivalenlEI to 
the reference experiment ( and the physical state and measurement observables are equivalent to the 
reference state and measurement observables) if there exists a local isometry 



The isometry <P may be constructed by attaching ancillae in some product state |00 . . . 0)_:(^ and 
applying local unitaries to the subsystems. Note that if we make any finite number of changes 
from the list above then we may construct a suitable local isometry and show that the experiment 
is equivalent to the reference experiment. Also, any experiment that is equivalent to the reference 
experiment may be constructed by applying changes from the list above: one simply attaches ancillae 
in the state \junk) and performs a suitable change of basis. The content of the main theorem is 
that, for a carefully chosen experiment, these are the only changes that preserve the statistics. 

Theorem 1 (Mayers and Yao). Suppose a physical experiment reproduces the statistics of the 
reference experiment described in section \ 3.Si Then the physical experiment is equivalent to the 
reference experiment. 

A simplified proof for the Mayers- Yao self-test is give in appendix [Cl 



^ = ^1 (g) . . . ^n, : yj ^ yj (g) Xj 



(3) 



such that 




(4) 
(5) 



* Note that this is not an equivalence relation since it is not symmetric. 



3.2 Mayers- Yao self-test reference experiment 

A general schematic for the Mayers- Yao reference experiment is shown in figured] A bipartite state 
is distributed to a pair of measurement devices. The two measurement devices take classical 
inputs a and b, which each take one of three values. The devices then output classical bits, x and 

y- 



a 




b 

Fig. 1. Mayers- Yao self-test circuit 

The reference state is an EPR pair \4>+) = (1 00) + the reference measurement 

observables are X, Z, for each side of the EPR pair. For brevity we label = -D. For the 
untrusted physical devices this equality is not given, so there the separate label D is required. 

4 Extending the Mayers and Yao self-test 

The original Mayers and Yao EPR test utilized only a small set of measurements. Conspicuously 
missing is anything with complex coefficients. An important consequence of this is that the circuit 
test developed by Magniez et al. |MMMU06j is not able to test gates with complex coefficients; only 
gates with real coefficients can be tested. More specifically, real measurements reveal no information 
about the imaginary component of a density matrix. 

In fact the Mayers- Yao self-test cannot be directly extended to include any measurements with 
complex coefficients. This is a result of the notion of equivalence used. Suppose that we wish to 
include the Y measurement in the set of reference measurements. The devices could instead imple- 
ment — Y, the complex conjugate. So long as all complex measurements were complex conjugated 
it would be impossible to detect this change. Although this does not present an immediate problem 
- such a transformation is internally consistent and produces the correct outcome statistics - we 
cannot transform such a circuit back into the reference circuit using unitary transformations. 

If this were the whole story we could simply require that the physical circuit be transformable 
into either the reference circuit or its complex conjugate. However, the real simulation, and now the 
general family of simulations, are also indistinguishable from the reference circuit and not unitarily 
transformable into the reference circuit. 

We have one encouraging fact: all of the known simulations are equivalent to a simulation from 
the general family of simulations. We now prove that we can extend the Mayers- Yao test such that 



these are the only simulations. Hence we may extend our notion of equivalence to include these 
simulations and obtain a new self-testing theorem. 

Theorem 2. Suppose a physical experiment duplicates the statistics generated by the reference 
experiment described in section \4-l[ Then the physical experiment is equivalent to one of the simu- 
lations of the reference experiment described in section \^ 



4.1 Extended Mayers- Yao self-test reference experiment 

The extended Mayers- Yao test will consist of three regular Mayers- Yao tests, performed together. 
Alice and Bob will perform the Mayers- Yao test with measurement settings (labelled with subscript 
A when used by Alice, and subscript B when used by Bob): 

1. X, Z, and D 

2. X, y, and E 

3. y, Z, and F. 

In the reference experiment the measurement settings X, Y and Z are realized by the Pauli 
operators, with Yg = —Y and otherwise X^ = Xb = X,Ya = Y, Z^ = Z^ = Z. The other settings 
are realized hy Da = Ea = Fa = ^ on Alice's side and Db = Eb = 

Fb = on Bob's side. Bob's measurements all carry the —1 phase since measuring the state 
\(j)+) with the operator Y (S>Y produces —1 instead of 1 as in the Mayers- Yao reference experiment. 
The reference state is again | 



4.2 Proof of Theorem [2] 

We start by assuming that the states are all pure as in the Mayers- Yao test. Again we may incor- 
porate the purification of a mixed state into either Alice or Bob's state by adding an ancilla. 

First we apply the Mayers- Yao result with the measurements X, Z and D. We find a local 
isometry as in definition [TJ We extend ?P by adding an extra qubit for each side initialized in the 
state 1 0) . Then <P takes the Xa , Za , Xb and Zb measurements to Xq^ I^j^ (g) /^^ , Zq^ I^j^ (gi Is^ , 
XQg iRg 0Isb ZQg iRg 'i^Iss where Ra and Rb are the added qubit registers and Sa and 
Sb are the junk registers. Meanwhile the state has the form |(/)+)q^q^ , |00) 

RaRb SaSb' 

We now consider the remaining measurements. The reference experiments for these measure- 
ments can be transformed using local unitaries into the usual Mayers- Yao reference experiments. 
Thus we may apply the result. However, we stop short of using the full result. Within the proof of 
Theorem [T] we achieve the following result. 

Lemma 1. Suppose a physical experiment reproduces the statistics of the Mayers- Yao reference 
experiment described in section WM . Then the physical measurements Xa and Za anti-commute on 
the support of the physical state, as do Xb and Zb- 

This is shown in section IC.2I When we apply this result to the remaining measurements in the 
extended test, we find that Xa and Ya anti-commute on the support of the state, as do Xb and 
Yb, Za and Ya and Zb and Yb- For the remaining discussion we will limit ourselves to the support 
of the state. 

Consider the A side measurements first. We may express Ya as 



yA = Y^ Vp,ePqa ® IRa ® 
P,E 



where the P ranges over the Pauh operators and the E ranges over a basis for the Hermitian 
operators on Sa- 

Since anti-commutes with Xq^ ^RaSa coefficients of ah the terms with P = X must 
be 0. Indeed, since -Ya = {Xq^ (g) Iit^sA)YAi^QA <^ ^RaSa) we have 

- J2 VP'EPQa ® IRa ^Es^= Y1 Vp^ePqa ® IRa ^ - Yl Vp^ePqa ® IRa ® 
P,E P&{I,X},E P&{Y,Z},E 

where on the right hand side we have separated out the terms that commute with Xg^ iS" IraSa 
and those that anti-commute. We see that we must have yx,E = —yx,E = and yi^E = —yi,E = 
for &\\E. 

Applying similar reasoning and the test with Y and Z we find that yz,E = for all E. Thus 
Ya = Yq^ Ir^ (g) Ms^ for some Hermitian and unitary Mg^ . Next we compose with a "phase 
kickback" circuit consisting of a Hadamard gate on the Ra register, followed by a controlled , 
controlled on the Ra register, and a final Hadamard gate on the Ra register. This results in a new 
isometry (we will still call it ^) such that 

^{Yqa 0Ms^m = Yq^ Zr^ \<P+)q \junk)^s ■ (6) 

This is essentially the well known translation of a two outcome measurement into a qubit measure- 
ment. Also, since the addition of the phase kickback did not operate on the junk register the X 
and Z measurements are not affected. 

The above process can be repeated for Bob's side, with analogous conclusions. In order to be 
consistent with the reference experiment, we may construct our isomorphism so that 

${Yq^ Ms^ m = Yq^ Zr^ \junk) . (7) 

We have thus shown that the measurements are as in the general simulation. 

We now turn our attention to the state. From the Mayers- Yao test on X and Z we know that the 
state on Qa®Qb (after applying cp) is \4>+)- We next consider the state on the remaining registers, 
\junk)j^g. We may express this in the singular value (Schmidt) decomposition, split between Rab 
and Sab- 

\(^) = T.^^\3)ras\j)sa. (8) 
j 

with Xj > 0. Since the Y measurement setting gives correlated results (recall we introduced a -1 
factor on the B side measurement observable) and the form of Ya and Yb, the states must 
all be eigenvectors of Zr^ (g Zr^ . If this were not the case then a —1 phase would be introduced 
and the measurement results would be incorrect at least some of the time. Thus the only possible 
states for Ij)/?^^ are superpositions of |00) and |11). We do some relabelling and arrive at 

IV') = \^+)qas ® ("|00)«.. 1^00)5,, 1^11)5.0 (9) 

with l^oo) and not necessarily orthogonal. Note that tracing out the Sab ancillae results 

in a state exactly as described by the multi-party simulation in section [2j Thus we have demon- 
strated that the physical experiment is equivalent to one of the general simulations of the reference 
experiment, and completed the proof of Theorem [2l 



5 Cryptographic setting 



Suppose that two or more parties are engaged in a cryptographic protocol using self-tested appa- 
ratus. The extended Mayers- Yao test above allows them to determine that the devices are imple- 
menting a simulation from the family of simulations described in section [2j Suppose further that 
the adversary, Eve, knows how the devices are implemented and controls the preparation of the 
state. The honest parties only perform operations as specified for the simulation. Eve, on the other 
hand, is free to interact with the extra qubits in the simulation in any way she likes. Does this give 
any advantage to Eve? 

Eve can potentially perform many operations, including entangling a qubit of her own with the 
extra simulation qubits allowing her to perform simulation operations. She may also interact in 
complex ways with the extra simulation qubits along with the original register. Despite this, we are 
able to prove that Eve can gain no advantage for some protocols. 

We explore a restricted class of protocols that are especially easy to analyse. These are protocols 
where the only operation that an honest party will do is a Pauli measurement. This class includes the 
six-state quantum key distribution protocol (implemented in as an entanglement based protocol) 
[BBBW84] . [Bru98] . We will demonstrate that these protocols do not leak any more information 
when implemented using one of the simulations. 

The proof is a series of security reductions to protocols in which each reduction only increases 
Eve's power. We will show that the final protocol in the reduction is just as secure as the reference 
protocol (without the simulation applied), hence the simulation protocol is also just as secure as 
the reference protocol. 

For the first reduction we suppose that the participants in the protocol measure their simulation 
qubit in the Z eigenbasis after the protocol is completed, and transmit the result to Eve. This 
does not interfere with the intended protocol and only increases Eve's information. Since the Z 
measurement commutes with all simulation operations, the participants could just as well have 
performed the measurement before the protocol began. If Eve is the one who prepares the initial 
state for the simulation (in other cases Eve has strictly less power) then Eve could also perform 
this measurement herself. This measurement would collapse the state to an eigenvector of the Z 
measurements and Eve's strategy would be a mixture of different strategies with the states each an 
eigenvector of the Z measurements. 

Let us examine the result of Eve choosing one of these eigenvector states. Each of the parties 
will receive their extra qubit prepared m a Z eigenvector. The effect of this on their operations is 
either to perform the protocol's original operation (in the case of a |0)) or the complex conjugate 
(in the case of a |1).) For Pauli measurements, only the Y measurement is affected: the output bit 
is flipped in the case of the complex conjugate. 

If every party receives the same eigenvector in their extra qubit, then the protocol reduces to 
either the original or the complex conjugate. In either case the security is identical to the original 
protocol. If the extra qubits are not in the same eigenvector then some Y measurements outcomes 
will be flipped and some will not. This does not affect Eve's information since she controls which 
outcomes are flipped and can undo the flips in her reckoning of the final classical information. Note 
that the bit flips may introduce errors into the protocol. If the protocol does not explicitly check for 
such errors (as does the 6-state protocol) information will still not be leaked to Eve, however a test 
for these errors may be required to make sure the protocol functions correctly. The final protocol, 
and hence the simulation, is thus as secure as the original protocol. 



6 Conclusions and Future work 



6.1 Conclusions 

Theorem [21 along with the security result of section \5\ allows us to analyze the case of the 6-state 
QKD protocol in the self-tested framework. In particular we may define a self-testing version of the 
6-state protocol in which the extended Mayers- Yao test is incorporated along with the usual 6-state 
protocol. Given a robust version of the test (see section 16. 2p we may first estimate the state and 
measurement observables, then apply a security proof for the 6-state protocol in order to derive a 
secure key rate. 

Although a self-tested 6-state protocol is currently not practical, nor likely to become so, the 
result is interesting from a theoretical perspective within the self-tested framework. Previous results 
were limited to real Hilbert spaces, one could apply the real simulation explicitly within the reference 
experiment and then proceed with the self-test. This works fine for circuits, where only the correct 
outcome is important, however the 6-state protocol introduces other concerns, namely the possibility 
of information leaking to an adversary. The current work thus illustrates how a self-test for complex 
operations provides additional benefit over the previous self-tests. 



6.2 Future vi^ork 

Note that we have not described a physically realizable test in section HI The proof requires that the 
expected value of the observables match the reference exactly. This cannot be established physically 
without some kind of repeatability assumptions and an infinite number of trials. The original test 
by Mayers and Yao was shown to be robust in |MMMO06| . establishing a polynomial relationship 
between the precision of the statistics and the closeness to an EPR state. We are currently studying 
the robustness of these new tests. This is an important line of future research. A related task is to 
extend the results to continuous variable systems. 

Another interesting line of research is to follow the same path as Magniez et al. to obtain a 
self-testing circuit for arbitrary circuits, now allowing complex gates. The framework and proofs 
from [MMMO06j offer a roadmap for such research, but there are some technical problems that 
arise along the way so a straightforward adaptation is not possible. These are due to the larger 
Hilbert space created when adding the extra qubits to allow the simulations. 
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A Evolution in simulations 

We can extend the measurement operator defined in [2] to arbitrary operators. We define 

C(M) = |0)(0| «)M + |1)(1| ® M*. (10) 
Note that C(M) can be expressed differently as 

C{M) = I(E)Re{M)+iZ®Im{M) (11) 

where Re{M) and Im[M) are the real and imaginary parts of M (both real matrices). In the case 
of a multi-party simulation, the Z operates on a particular party's added qubit. 
We summarize some of the properties of C{M) here 

Lemma 2. Let M and N he matrices. Then we have the following: 

1. C{MN) = C{M)C{N). 

2. C{M + N) = C{M) + C{N). 

3. Let a he a real number, then C{aM) = aC{M). 

4- If {ip) is an eigenvector of M with eigenvalue \, then |0) |^/^) and |1)|^) are eigenvectors of 
C{M) with eigenvalues A and \* , respectively. 

5. C{M) is Hermitian if and only if M is. 

6. C{M) is unitary if and only if M is. 

7. C{M) is positive semi-definite if and only if M is. 

8. When M is Hermitian, Tr{C{M)) = 2Tr{M). 

These properties can be derived easily. 

Discrete time evolution The properties of C(-) allow us to easily determine how the simulation 
states in the continuum evolve. Let U and {ip) be a reference unitary operation and state and let 
p' be as in equation [TJ By the form of C{U) we have 

C{U)p'C{U)^ = a |0)(0| (g) U U^ + {1- a) |1)(1| ® U* 

c|o)(i| u IV'XV'*! + c* |i)(o| ® u* ul 

But this is the simulation state for U \ip), and hence C{U) evolves the simulation state p' to produce 
a new simulation state corresponding to U \ Compositions of unitaries will also evolve the state 
correctly so that the measurement statistics at the end of a circuit will be identical to that of the 
reference circuit. 

General quantum operations may be mapped similarly. It is easy to verify that in Kraus rep- 
resentation a completely positive map is mapped to a completely positive map if we apply C(-) to 
each of the Kraus operators. The trace preserving property is also preserved. We apply the same 
reasoning as for U above to with each Kraus operator. The linearity of C then allows us to conclude 
that the simulation map will behave correctly. That is to say, it will map p' to a new simulation 
state corresponding to evolved under the reference map. 



Continuous time evolution We begin with a Hamiltonian H. One can simulate the Schrodinger 
evolution of H on IV') by evolving H* on backwards in time, or equivalently, evolving the 
system according to —H*, and measuring with conjugated observables. 

Thus, the simulation of the evolution of H can be achieved using the Hamiltonian 

H' = \0){0\ H - ^ H* . (12) 

The evolution of the state according to the Schrodinger equation 

U{t) = e-'^'' (13) 

gives 

e-*^'* = |0)(0| e-'"' + |1)(1| e-^(-^*)* = |0)(0| e''"' + |1)(1| (e"^^*)* = C{e-'^') (14) 

(using the fact that exp(^ + B) = exp{A) + exp{B) when AB = = BA, and that exp {P (g, A) = 
P (g) exp(^) when P"^ = P). Thus 

^-iH't ^ c{e-'^') (15) 

and the simulation evolution tracks that of the reference system. 

Another way to arrive at the same H' is the approach used in the real simulation |MMG09] . 
There, rather than considering the Hamiltonian alone, the whole matrix in the exponent, —iHt, 
was considered. Applying C(-) to this matrix we obtain 

|0)(0| {-iHt) + |1)(1| {-iHty = i (|0)(0| ^H- |1)(1| ® H*) t (16) 

Here the fact that a*b* = (ab)* means {—iH)* = iH* and the —1 factor is explained. 



B Real simulation in the family 

The real simulation presented in |MMG09] can be expressed as a simulation in the family defined 
above through a change of basis. Starting with the state defined as in [T] with a = c = ^ the 
simulation state is pure and equal to 

We next apply a Hadamard gate followed by the relative phase rotation 

1 

-i 

to the extra qubit. This is the same as applying the unitary 
The resulting state is 

^\o)i\^) + \r))-'-\i)m-\r)) 

which can be rewritten as 

\0)Re{m + \l)Im{m 



which is the real simulation described in 

Operators are transformed quite easily. For operator M we conjugate C{M) hy U <^I. FromfTT] 
we see that the resulting operator is 

(U I)C(M)(U^ 01) = 10 Re{M) +XZ0 Im{M) (18) 

which is exactly the operator used in the real simulation for M. 

The states used in the multi-party simulation in [MMG09] are stabilized hy Yg 0)Yt for distinct 
s,t. Also note that the states used in the simulations defined here are stabilized by Zs ® Zt for 
distinct s, t. The qubit-wise transformation applied transformations Z into y, so the multi-party 
states are also transformed correctly. 



C Simplified proof for Mayers- Yao self-test 
C.l Proof Overview 

The main advantages of the following new proof for the Mayers- Yao self-test is that it is shorter, 
clearer, and more naturally extends to the more general test given in this paper. 

The proof has two distinct parts. The first part establishes some equations on the state and 
observables based on the observed statistics. These are straightforward and are a direct result of the 
statistics observed. Next we use these equations to show that the X and Z observables on each side 
anti-commute on the support of the state. The second part uses the anti-commuting observables to 
construct local isometrics that take the state and observables to the reference state and observables. 

One important consideration is that of the support of the state. Since we do not make any 
claims about the state and observables outside the support of the state we disregard the rest of the 
Hilbert space. In this way we will not make any more reference to the support of the state. 

C.2 Observed statistics imply anti-commuting observables 

Statistics In the reference test the marginals for each observable are all 0. That is, 

{^+\M0l\cp+) =0 

for M S {X,Z,D}. (Swapping the systems in this and the following equations gives the same 
result since is symmetric.) Measuring the same observable on both sides always give identical 
outcomes. Thus 

(</.+ ! M0M|(/.+) = 1. 
Additionally, X and Z measurements are uncorrelated. 

(</.+! = 0. 

The interesting part comes when we measure X or Z on one side and D on the other. 

((^+1 X0D 10+) = (</.+ ! Z0D \ct>+) 



^ This part of the real simulation was previously well known 




State equalities Using the equations from section 13.21 on the measurement outcomes combined 
with the fact that {ip) is normahzed gives us the fohowing equations 



1 / 


= Xa® XbW) 


(19) 




= Za®Zb Wi 


(20) 




= Da(^Db\^) 


(21) 




;) =/»Xb|V> 


(22) 


ZA®i\i 


>)=I(^ZbH) 


(23) 


Da<E)IH 


>)=I^DB\i^) 


(24) 


XaZa^IH 


,)=I(^ZbXbH) 


(25) 


ZaXa^IH 


>)=I®XBZB\i') 


(26) 


XaZa^IH 


i)=Xa® Zb |V> 


(27) 


ZaXa^IH 


>)=Za® Xb IV) 


(28) 



We can also establish some orthogonality relationships between various vectors. In particular 
the vectors |^/^) , Xa (8> / IV') j Za ® ■, XaZa ® I\'4') are pairwise orthogonal. 

Our goal for the remainder of the proof is to show that any state for which these equations hold 
must be equivalent to | </>+). 



Anti-commuting observables We now move to more salient matters. First, we note that Da ® 
I IV) must be in the space spanned by Xa ® and Za ® because it has overlap with 
each of these orthogonal vectors, and it has norm 1. Thus 

Da®I\^) = ^^^^®I\ij) 
v2 

and analogously for I Db\iP)- This allows us to make the following deductions 



IV) =Da(S)Db IV) 

= ^(XA + ZA)®(XB + Zij)|V) 

= IV) + (Xa ®Zb + Za® Xb) |V) 
Applying equations [22] and [23] we obtain 

{XaZa + ZaXa) ® / 1 V) = 0. (29) 

By Lemma[3l below, it follows that Xa and Za anti-commute on the support of |V) on A. Similarly, 
the observables Xb and Zb anti-commute on support of |V) on B. 

Lemma 3. Let Xa and Za he operators and |V)a_b bipartite state such that 



XaZa ® Ib IV) as = -ZaXa ^ Ib IV) ab • 
then XaZa \4>) = —ZaXa \4') for any \4>) in the support of |V)ab ''^ 



(30) 



Proof. Let 

IV') = E^^-|j')aU>b- 

j 

be the singular value decomposition of |^). We then have 

XaZa (S)IbY1 \^)a \3)b = -ZaXa ®IbY^ \^) A \j) s ■ 



(31) 



(32) 



We now take the inner product with \k) ^\k') ^ for some fc, k' to obtain 

{^a^aZa |j)a = -^3 {Ha^aZa |j)a 



(33) 



When we restrict to the subspace to the subspace spanned by the \k) for which Afc 7^ (i.e. on 
the support of 1-0) on A) we find that XaZa = —ZaXa- 

C.3 Local unitary transformations 

Now we can easily build the local unitaries required to extract the EPR pair. We use the circuit 
shown in figure [2j There the outer 1 0) states are added while the two inner wires carry the two 
halves of the bipartite state This circuit essentially builds a SWAP gate out of two CNOT 
gates (the usual third gate is not necessary since we initialize with |0).) The SWAP gate extracts 
the entanglement out of \ip) and swaps in a product state. 



|0) —H 



H 



Za 



Xa 



Zb 



|0) —H 



Xb 



H 



Fig. 2. Circuit for <P showing equivalence of physical circuit to reference circuit in Mayers- Yao test 



The circuit gives two isometries, one for each wire in EPR test circuit, which we denote ^a and 



State After applying this circuit the resulting state is 

^A ® '^Bim = -^{I + Za)®{I + Zb) I^) |00) 

+ ^(/ + Za)0Xb(/-Zb)|^)|O1) 
+ -^XA{I-ZA)®{I + ZB)\^)m 



-Xa{I - Za) (^Xb(I- Zb) \^P)\n) 



Applying some equations and the anti-commuting result from the previous section we find that this 
is equal to 

® ^b(IV')) = \ii + Za) ® (/ + Zb) (|oo) + 111)) + 

(/ + ZaKI - Za) Xb IV) |01) + Xa (/ + Zb){I - Zb) |10) 

= 1={I0I + I0Zb)\^)\(I)+) 

This may look curious since / + Za and I + Zb are not unitary. In fact it is easy to show that 
the final state still has the correct norm. To give some intuition, note that in the reference case we 
want to extract |i;^>+) and swap in |00) = ^~^(-^ + Z) ^ {I + Z) 

Measurement operators We now turn to equivalence of the measurement operators. We start 
with Xa (the result for Xb follows analogously). Applying Xa to {ip) before applying the circuit 
is the same as applying it at the end, with a —1 phase introduced by anti-commuting past the 
controlled Za operation (recall from section IC.2I that Xa and Za anti-commute on the relevant 
subspace). The resulting state is 

^A ® ^b^Xa Ib m = \xAiI - Za) 0(1 + Zb) |V) |00) 

+ ^Xa{I - Za) 0XBiI- Zb) |V) |01) 
+ ^{I + ZA)(^{I + ZB)m\W) 
+ ^(/ + Za) ^ Xb{I - Zb) I^j) |11) 



Following the same logic as used in the state equivalence, we find that the final state is 

^aCS'Pb{Xa(^I\iI^)) = -^{I®I + I®ZB)\i^) {X®I)\(j)+) 

v2 

For the Za operation, we see that the effect is a —1 phase kicked back through the final controlled 
Xa operation. This phase appears on the terms with 1 1) in the qubit, exactly as if a Z operation had 
been applied to the qubit. The equivalence for the D operators results from the fact that D = 
on the relevant subspace, and linearity. 

This concludes the proof of Theorem [1] . 



